https://seclists.org/oss-sec/2026/q4/95: CVE-2026-66087: Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint

Q: Who can exploit this issue?

An attacker must be authenticated to Apache DolphinScheduler. The flaw lets authenticated users operate task instances in projects they are not authorized to access.

Q: Which operations are exposed?

The affected endpoints allow stopping a task instance or creating a savepoint for a task instance. They are the project task-instance stop and savepoint endpoints.

Q: Which versions need remediation?

Apache DolphinScheduler versions before 3.4.3 are affected. Upgrade to version 3.4.3 to obtain the fix.

Published Oct 8, 2026

Updated

Affected Software

1 affected component

Apache Dolphinscheduler<3.4.3

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated to Apache DolphinScheduler. The flaw lets authenticated users operate task instances in projects they are not authorized to access.

Which operations are exposed?

The affected endpoints allow stopping a task instance or creating a savepoint for a task instance. They are the project task-instance stop and savepoint endpoints.

Which versions need remediation?

Apache DolphinScheduler versions before 3.4.3 are affected. Upgrade to version 3.4.3 to obtain the fix.